CVE-2026-42707

WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42703

WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39741

WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-22386

WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-118093

WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116855

WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My auctions allegro: from n/a through 4.0.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-116404

WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability

Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting Sensitive Data Embedded in Cache.This issue affects Redux Framework: from n/a through 4.5.16.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Davidanderson Wordpress-extensions

Products

Redux Framework Redux Framework

CVE-2026-102682

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot sessions and Daily rooms. The runner binds to localhost by default and is intended only for local development, so exploitation requires an operator to expose it to untrusted traffic through --host 0.0.0.0, a published port, or a tunnel without access controls. An unauthenticated caller can consume local resources and third-party quotas and, depending on configuration, receive a room URL and join token. Version 1.6.0 adds a prominent development-runner banner and documentation that clarifies the unauthenticated boundary and directs production deployments to an authenticated dispatcher or managed runtime, while the endpoint behavior remains by design. This issue is fixed in version 1.6.0.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Pipecat-ai

Products

Pipecat

CVE-2026-27401

WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH PayPal Express Checkout for WooCommerce: from n/a through 1.62.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-115963

WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-115599

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Thimpress Wordpress-extensions

Products

Learnpress Learnpress

CVE-2026-112827

WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce handmade-dropshipping-for-etsy-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HANDMADE – Dropshipping for Etsy and WooCommerce: from n/a through 1.0.10.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-78395

Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass

The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Link Library

CVE-2026-108685

WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Post Author

CVE-2026-115373

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET /1.0/operations/{uuid} that lets project-restricted clients read operations in other projects. Attackers holding a restricted certificate and a known operation UUID can retrieve command lines, environment secrets, websocket secrets, and trust enrolment tokens.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Linuxcontainers

Products

Incus

CVE-2026-93865

Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection

A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-90465

Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-57116

PraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation

PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mervinpraison

Products

Praisonai

CVE-2026-56835

PraisonAI Slack app_mention bypasses configured user/channel authorization

PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handler, but not in the adjacent Slack app_mention event handler. A Slack workspace user who can mention the bot in a channel where the Slack app is present can trigger the configured PraisonAI agent even when: the sender is not in BotConfig.allowed_users; the channel is not in BotConfig.allowed_channels; unknown_user_policy="deny" is configured; and the same event content is correctly dropped by the normal message handler. This issue has been patched in version 4.6.59.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Mervinpraison

Products

Praisonai

CVE-2026-85655

Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow

The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. The doReplaceQuery() method performs a database-wide search-and-replace across all posts containing the old media URL without any per-post capability check, meaning a single Author-triggered request can silently overwrite a large number of posts that WordPress's standard admin UI and REST API would otherwise forbid that user from editing.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Shortpixel Wordpress-extensions

Products

Enable Media Replace Enable Media Replace